Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2025-2331 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u | medium | 5.3 | 0% |
| CVE-2026-47743 | shopper/framework | Shopper: Multiple data integrity and disclosure issues in admin Livewire components | high | 8.7 | 0% |
| CVE-2024-40633 | sylius/sylius | Sylius has a security vulnerability via adjustments API endpoint | high | 7.5 | 0% |
| CVE-2024-13451 | bit-form (WordPress plugin) | The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP | medium | 5.3 | 0% |
| CVE-2024-8902 | addon-elements-for-elementor-page-builder (WordPress plugin) | The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13 | medium | 4.3 | 0% |
| CVE-2024-8913 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 4.3 | 0% |
| CVE-2024-10360 | move-addons (WordPress plugin) | The Move Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3 | medium | 4.3 | 0% |
| CVE-2024-6553 | wp-meteor (WordPress plugin) | The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and includi | medium | 5.3 | 0% |
| CVE-2024-6571 | imageseo (WordPress plugin) | The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions u | medium | 5.3 | 0% |
| CVE-2024-56526 | oxid-esales/oxideshop-ce, oxid-esales/oxideshop-metapackage-ce, oxid-esales/smarty-component | OXID eShop May Display User Information | high | 7.5 | 0% |
| CVE-2026-71293 | statamic/cms | Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering | medium | 6.2 | 0% |
| CVE-2026-67339 | guzzlehttp/guzzle | Guzzle: Proxy-Authorization headers can be sent to origin servers | medium | 5.3 | 0% |
| CVE-2025-13785 | yungifez/skuul | Skuul School Management System has a Sensitive Data Exposure Vulnerability in Uploaded Images | medium | 4.3 | 0% |
| CVE-2026-34970 | mantisbt/mantisbt | MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked | medium | 0.0 | 0% |
| CVE-2025-2228 | responsive-addons-for-elementor (WordPress plugin) | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive I | medium | 5.7 | 0% |
| CVE-2025-12468 | wp-marketing-automations (WordPress plugin) | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive I | medium | 5.3 | 0% |
| CVE-2026-35452 | wwbn/avideo | AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php | medium | 5.3 | 0% |
| CVE-2024-12560 | button-block (WordPress plugin) | The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in | medium | 4.3 | 0% |
| CVE-2024-12584 | xpro-elementor-addons (WordPress plugin) | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up | medium | 4.3 | 0% |
| CVE-2025-0318 | ultimate-member (WordPress plugin) | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.3 | 0% |
| CVE-2024-9627 | green-wp-telegram-bot-by-teplitsa (WordPress plugin) | The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization check | high | 8.6 | 0% |
| CVE-2024-25119 | typo3/cms-core | TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key | medium | 4.9 | 0% |
| CVE-2026-34579 | mantisbt/mantisbt | MantisBT has an authorization bypass in private issue monitoring | medium | 0.0 | 0% |
| CVE-2026-34744 | mantisbt/mantisbt | MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue | medium | 0.0 | 0% |
| CVE-2024-12329 | essential-real-estate (WordPress plugin) | The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pag | medium | 4.3 | 0% |
| CVE-2026-56385 | craftcms/cms | Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata | low | 0.0 | 0% |
| CVE-2026-57994 | phpmyfaq/phpmyfaq, thorsten/phpmyfaq | phpMyFAQ public FAQ APIs expose inactive FAQ content | medium | 5.3 | 0% |
| CVE-2024-11299 | memberpress (WordPress plugin) | The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.37 via the W | medium | 5.3 | 0% |
| CVE-2026-32265 | craftcms/aws-s3 | Amazon S3 for Craft CMS has an Information Disclosure vulnerability | medium | 0.0 | 0% |
| CVE-2026-32266 | craftcms/google-cloud | Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability | low | 0.0 | 0% |
| CVE-2025-1063 | classified-listing (WordPress plugin) | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in | medium | 5.3 | 0% |
| CVE-2023-48714 | silverstripe/framework | Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter | medium | 4.3 | 0% |
| CVE-2024-34003 | moodle/moodle | Moodle Authenticated LFI risk in some misconfigured shared hosting environments | medium | 5.9 | 0% |
| CVE-2024-10084 | contact-form-7-dynamic-text-extension (WordPress plugin) | The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Basic Information Disclosure in all versions up to, and in | medium | 4.3 | 0% |
| CVE-2024-7063 | elementskit (WordPress plugin) | The ElementsKit Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.6 via the | medium | 4.3 | 0% |
| CVE-2025-12426 | quiz-maker (WordPress plugin) | The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is | medium | 5.3 | 0% |
| CVE-2024-48900 | moodle/moodle | Moodle IDOR when accessing list of badge recipients | medium | 0.0 | 0% |
| CVE-2024-10365 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to | medium | 4.3 | 0% |
| CVE-2024-10319 | xpro-elementor-addons (WordPress plugin) | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up | medium | 4.3 | 0% |
| CVE-2024-10352 | magical-addons-for-elementor (WordPress plugin) | The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, | medium | 4.3 | 0% |
| CVE-2024-9541 | news-kit-elementor-addons (WordPress plugin) | The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2 | medium | 4.3 | 0% |
| CVE-2024-9889 | elementinvader-addons-for-elementor (WordPress plugin) | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl | medium | 4.3 | 0% |
| CVE-2025-4523 | idonate (WordPress plugin) | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a | medium | 6.5 | 0% |
| CVE-2026-64664 | statamic/cms | Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence | medium | 4.3 | 0% |
| CVE-2024-6551 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and | medium | 5.3 | 0% |
| CVE-2024-47059 | mautic/core | Mautic allows users enumeration due to weak password login | medium | 4.3 | 0% |
| CVE-2026-33041 | wwbn/avideo | AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php | medium | 5.3 | 0% |
| CVE-2025-3628 | moodle/moodle | Moodle reveals student identities through assignment submissions search on anonymous submissions | medium | 4.3 | 0% |
| CVE-2026-43885 | wwbn/avideo | AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization | high | 0.0 | 0% |
| CVE-2026-55792 | craftcms/cms | Craft CMS: Sensitive File Disclosure / Server-Side File Read | medium | 0.0 | 0% |